May 30, 2006 3:01 PM PDT

Symantec patches antivirus worm hole

Symantec over the weekend delivered fixes for a high-profile flaw in its corporate antivirus products that could be exploited in an Internet worm attack.

Users of Symantec AntiVirus Corporate Edition and Symantec Client Security should apply the appropriate update as soon as possible, Vincent Weafer, a senior director at Symantec Security Response, said Tuesday. However, because there are no known attacks that exploit the flaw, the need to patch is not urgent, he added.

The vulnerability was initially reported last week by eEye Digital Security. The flaw, a remotely exploitable buffer overflow, could potentially allow an attacker to run malicious code on a vulnerable computer. Because Symantec's software is so widely used, this could cause havoc on the Internet--for example, if a worm were to exploit the problem.

Got views on Vista?

Recognizing the urgency to deliver a fix, Symantec worked over the weekend--a holiday weekend in the U.S.--to deliver patches. "Since it was publicly reported, we did have to go into emergency mode and deliver patches for the products," Weafer said.

Ubiquitous antivirus software is like low-hanging fruit to hackers, analysts have said. As the pool of easily exploitable Microsoft Windows bugs dries up, attackers are looking for holes in security software to break into PCs. Symantec realizes this, Weafer said.

"More eyes are looking for these vulnerabilities," he said. "This is clearly something we're going to look at ourselves. We can use this as a lesson to determine if there is any change needed to our secure programming."

Symantec has fixes available for the English versions of its products. The Cupertino, Calif., company is still working on updates for international versions. The products affected by this security issue are Symantec AntiVirus Corporate Edition version 10.x and Symantec Client Security version 3.x.

See more CNET content tagged:
Symantec Corp., Symantec AntiVirus, flaw, antivirus, fix

2 comments

Join the conversation!
Add your comment
am i reading this correctly?
what? no known attacks that exploit the flaw & the need to patch is not urgent?

Somebody please give Vincent Weafer some lessons in PR.

it's expected that the company i'd pay for software security would be on their toes and taking care of any concerns irregardless if it's immediate or not.

Luckily, Symantec hasn't felt what Sony is feeling right now (yet). Hit the panic button when necessary. It's a sunny summer now.
Posted by stollerby (1 comment )
Reply Link Flag
Hey, no holes with PCTOOLS!
There just aren't any, all the viruses just don't come in!
When you have some time, why not give it a spin.

To check it out visit <a href="http://www.pctools.com/free-antivirus/"> http://www.pctools.com/free-antivirus/ </a>

Elvis Locklier
Posted by pctools-free-anti-virus (2 comments )
Reply Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.